EUVD-2026-119513

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124456

OpenEMR versions before 8.3.0 are vulnerable to missing authorization and insecure direct object reference (IDOR) flaws within the oe-module-prior-authorizations module. These vulnerabilities allow authenticated low-privilege users to interact with other patients' records. Specifically, attackers...

CVE-2026-124456: openemr: OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the…

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...